OpenRouter paste-only PKCE authentication.
Purpose
-------
Exchange a manually pasted authorization code for a provider key.
Responsibilities
----------------
Generate PKCE, display the URL through callbacks, and enforce transport policy.
Diagnostics
-----------
Domain: OC_CHAT.CLIENT
Levels:
L2 - lifecycle
L3 - semantic details without credentials
L4 - module lifecycle
Contracts
---------
No listener, browser launch, refresh, proxy inheritance or redirect following.
The operator approved this fixed-endpoint sink outside ClientInterface for P6.
Credentials and transport exception contents never reach output channels.
Dependencies
------------
- oc_diagnostics (diagnostics)
- httpx (existing provider transport dependency)
- option_c_agent_contracts.provider_plugin (OAuth protocols and credentials)